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Summary 

The verification and validation process is a critical por- 
tion of the development of a flight system. Verification, the 
steps taken to assure the system meets the design specifi- 
cation, has become a reasonably understood and straight- 
forward process. Validation is the method used to ensure 
that the system design meets the needs of the project. As 
systems become more integrated and more critical in their 
functions, the validation process becomes more complex 
and important. This paper discusses the tests, tools, and 
techniques which are being used for the validation of the 
high alpha research vehicle (HARV) turning vane control 
system (TVCS) and documents the problems and their solu- 
tions. The emphasis of this paper is on the validation of an 
integrated system. 

Nomenclature 

A/D analog to digital converter 

Ames-Drydcn Ames Research Center, Dryden Flight 

Research Facility 

DDI digital display indicator 

EMI electromagnetic interference 

FCS flight control system 

FMET failure mode and effects tests 

HARV high alpha research vehicle 

HIL hardware in the loop 

HOL higher order language 

HUD head-up display 

INS inertial navigation system 

I/O input/output 

ITF Integrated Test Facility 

MC mission computer 

M t normal acceleration 

PCM pulse code modulation 


RAM 

random access memory 

RAV 

remotely augmented vehicle 

RFCS 

research flight control system 

SID 

simulation interface device 

TVCS 

turning vane control system 

UMN 

universal memory network 

V&V 

verification and validation 


Introduction 

The F- 18 high alpha research vehicle (HARV) flown at 
Ames Research Center, Dryden Flight Research Facility 
(Ames-Dryden) at Edwards, California is a flight-test plat- 
form for the High-Angle-of-Attack Technology Program. 1 
The two objectives of this program are to provide flight- 
validated design methodology including experimental and 
computational methods that accurately predict high-angle- 
of-attack aerodynamics, flight dynamics, and flying quali- 
ties; and improve controllability and agility at high angles 
of pttark and expand the usable high-angle-of-attack enve- 
lope. The aircraft provides a system which can allow ma- 
jor modifications while retaining the basic F-18 systems as 
a backup. 

The F-18 HARV was modified to add various research 
control modes. This modification was done by integrating 
a research flight control system (RFCS) with the basic F-18 
control system. The RFCS can take control of the aircraft 
while the F-18 control system continues to provide the in- 
put, output, redundancy management, and a backup for the 
RFCS. The basic F-18 flight control system (FCS) was not 
changed functionally but major modifications were required 
to provide an interface with the RFCS. 

A thrust vectoring control system (TVCS) was also added 
to the HARV. The TVCS modification includes the addition 
of thrust vectoring vanes to be used for high-angle-of-attack 
maneuvering by deflecting the engine exhaust. The avionics 
system was also modified to provide the appropriate infor- 
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mation to the pilot and inputs to the RFCS. This design re- 
sulted in the integration of avionics with the control system. 

The major modification of the basic F-18 control system, 
the integration of the avionics into the RFCS, and the struc- 
tural modifications of the aircraft dictated thorough testing 
of the F-18 system as well as the research system. Several 
tools were developed to test the modified HARV flight con- 
trol and avionic systems adequately. A simulation which 
could be configured was designed for the development, anal- 
ysis, and testing of the HARV systems. The unique con- 
figuration of the HARV TVCS required special testing ca- 
pabilities and tests as well as the standard validation tech- 
niques. The integration of the basic flight control computers, 
research flight control computers, mission computer (MC), 
and inertial navigation system (INS) introduced additional 
complexity and difficulty into the validation environment 
The validation testing of the modified system is considered 
to be the most important aspect in assuring a system is ready 
for safe flight test This paper will describe the modifica- 
tions incorporated in the HARV, the tests, tools, and tech- 
niques used for the validation of the HARV TVCS system. 

Aircraft Description 

The F-18 HARV aircraft was the sixth full-scale devel- 
opment aircraft. References 2 and 3 provide a general de- 
scription of the F-18 system. This aircraft was used for han- 
dling qualities investigations at high angles of attack, spin 
testing, and as a test bed for modifications to various sys- 
tems that would ultimately be included in production air- 
craft. NASA received the HARV configured as an early roll 
rate 1 aircraft with a single MC and a single digital display 
indicator (DDI) in the cockpit. Before the addition of the 
RFCS, modifications had been matte to add production sta- 
bilator actuators, redesigned inboard/outboard leading-edge 
flap transmissions, differential leading-edge flaps, roll rate 
2 flight control computers, a second MC, and a second DDI. 
The MCs had been upgraded with double density memory. 
A spin chute, emergency hydraulic system, and emergency 
electrical system had also been added to the aircraft for test- 
ing at angles of attack above 55°. The HARV configuration 
also includes two pulse code modulation (PCM) systems, 
five video cameras, and one 35-mm wingtip camera. 

System Modification Description 

The addition of the TVCS and the RFCS to the F-18 
HARV aircraft included modifications to the aircraft struc- 
ture, engines, the cockpit, avionics system, FCS, and hy- 
draulic system (Fig. I). 4 The system design uses the ba- 
sic F-18 avionics and FCS as a building block that handles 
the communications and health monitoring while the RFCS 
provides an experimental embedded computer that can take 
control of the aircraft The aircraft structure was modified 
by adding three turning vanes to each engine to provide 
thrust vectoring capability. Engine modifications included 
the removal of the external nozzle and a bias added to the en- 
gine control unit for increased stall margin. The cockpit was 
modified by the addition of switches for the pilot interface. 


Research Flight Control System Integration 

The integration of the RFCS into the F-18 system in- 
cluded provisions for flexibility, testability, and safety. The 
RFCS can perform alternate control law processing for re- 
search and turning vane control. The basic F-18 system is 
used for normal flight, take-off and landing, and if system 
failures occur. 

The RFCS control laws and basic F-18 control laws oper- 
ate in parallel (both computed continuously) throughout the 
flight envelope to reduce engagement/disengagement tran- 
sients. The basic F-18 system has been extensively tested in 
the high-angle-of-attack regime, and has been shown to be 
robust and controllable. 5 6 Because of the extensive testing, 
the functionality of the basic F-18 control laws was left un- 
changed except when it was required to incorporate RFCS 
input/output (I/O) and maintain control of the forward-loop 
integral path of the longitudinal control laws. The input and 
output of this integrator is reduced to zero when RFCS is 
engaged to prevent integrator windup and hard-over com- 
mands when switching from the RFCS to the basic F-18 sys- 
tem. A similar design is used in the RFCS control laws to 
reduce the integrators to zero when RFCS is not engaged. 

Another feature of the RFCS consists of requesting pa- 
rameters from the basic F-18 control system through dual 
port random access memory (RAM). The RFCS also con- 
trols the parameters available for downlink by way of the 
1553 data bus. This process is active whether or not RFCS 
is engaged. Therefore, data from the memory of either sys- 
tem can easily be made available on the 1553 data bus. 

A two-step process is used to engage the RFCS, and both 
steps are controlled by the basic F-18 system. A discrete 
from a cockpit switch informs the F-18 system that the pi- 
lot wants to arm the RFCS. The F-18 system then checks 
to assure conditions are proper for arming. No input, out- 
put, 1553 bus, actuator, or computer failures can be present. 
The RFCS does its own checks and sends a “GO” discrete 
across dual port RAM, which the basic F-18 system mon- 
itors. If arm conditions are met, the 701E sends out four 
discretes, one from each channel, to hold the solenoid-held 
arm switch. When the RFCS is armed, the basic F-18 sys- 
tem sets the turning vanes to a predetermined position near 
the boundary of the engine exhaust plume. The 701E con- 
trol laws continue to control the aircraft. The pilot can then 
engage the RFCS by using the existing nose wheel steering 
switch on the stick. Once engaged, the RFCS controls the 
aircraft and the basic F-18 system commands the actuators 
to positions provided by the RFCS. 

Other capabilities integrated into the RFCS include an 
RAV interface which allows inputs from a ground com- 
puter and a pilot-selectable switch used on a DDI. The pilot 
can select one of five settings, which the MC then sends to 
the RFCS. The RFCS only accepts the selection when not 
armed or engaged. Once engaged, the RFCS can then use 
the selection as an alternate gain, a flag for a new mode, or 
any other choice programmed into the RFCS. 
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Research Flight Control System Control Laws 

The RFCS control laws are completely independent of the 
basic F-18 control laws and can be easily modified without 
affecting the performance of the basic F-18. The RFCS con- 
trol laws could be as simple as a ‘'pass through mode for 
basic F-18 computed commands, since the basic F-18 sur- 
face commands are made available to the RFCS before the 
end of the computational frame. All nominal selected sen- 
sor signals are made available to the RFCS. Unique signals 
required by the RFCS are currently computed in the MC and 
passed to the basic F-18 system over the 1553 bus. The ad- 
ditional signals were not added to the basic system input se- 
lection management to maintain the original configuration. 

The initial RFCS design uses sideslip rate and angle of 
attack as primary feedback signals in addition to the stan- 
dard body axis rates and accelerations. The INS derived an- 
gle of attack is computed in the MC since the production 
F/A-18 angle-of-attack vanes are limited to approximately 
35° true angle of attack. Sideslip rate is computed from the 
kinematic equations of motion based on body axis accelera- 
tions, body attitudes and rates, and computed angle of attack 
and true velocity. The INS sideslip rate and angle of attack 
are single string inputs, since only one MC is being used at a 
time, and the HARV is equipped with a single INS. Comput- 
ing additional signals in the MC or in the RFCS eliminates 
the need for modifications to the basic system, but increases 
the system integration and the problems associated with a 
distributed system. 

The initial RFCS control laws were designed by McDon- 
nell Douglas Aircraft Company to demonstrate the TVCS 
system capabilities and to allow expansion of the RFCS 
flight envelope. The control laws are separated into lon- 
gitudinal, lateral-directional, thrust vane mixer, and gross 
thrust estimation sections. Propulsion system integration 
is localized into the thrust estimation and vane mixer sec- 
tions. In this way, modifications to the more standard longi- 
tudinal/lateral/directional control laws could be made with- 
out requiring complete knowledge of the complex interac- 
tions and gain scheduling associated with the thrust vanes 
and engines. 

Longitudinal control is an angle-of-attack command sys- 
tem using pilot stick position, angle of attack, pitch rate, and 
inertial coupling feedback as inputs. Normal acceleration is 
not used as a feedback. Collective stabilator, pitch thrust 
vectoring, and leading- and trailing-edge flaps are used for 
stabilization and maneuvering flight Trimming is done pri- 
marily with stabilators unless pitch thrust vectoring is re- 
quired because of stabilator saturation. At low angle of at- 
tack, when a normal acceleration (N t ) command system is 
desirable, commanded N, is converted to an angle of attack 
command using a simple computed jV t /anglc of attack and 
a 2 g/ in. stick gradient. This system will automatically fade 
to an angle-of-attack command system based on flight con- 
dition and stick position. 


The lateral-directional system uses roll rate and yaw rate, 
lateral acceleration, sideslip rate, and inertial coupling as 
feed bac k signals. Differential stabilator, aileron, rudder, and 
yaw vectoring are used for stabilization, coordination, and 
maneuvering flight. Lateral stick position commands the 
stability axis roll rale while the rudder pedal position com- 
mands sideslip angle. A system design goal is that no rudder 
pedal input is required for roll coordination. At low angles 
of attack and higher Mach numbers, the lateral-directional 
commands from the FCS are used in the RFCS with the addi- 
tion of some yaw thrust vectoring to augment rudder power. 

The performance of the six thrust vectoring vanes is a 
complex relationship dependent on nozzle exit radius, noz- 
zle pressure ratio, gross thrust, and on the position of the 
other vanes. To simplify the RFCS control law structure, 
a vane mixer was developed to coordinate the vane deflec- 
tions to achieve the commanded pitch and yaw vectoring 
moments. The control laws command a desired pitch and 
yaw vectoring moment to the mixer, which then computes 
the six vane deflections required to achieve the commanded 
moments. Gross thrust is estimated from engine parameters 
and used by the mixer to scale the desired pitch and yaw 
vectoring commands to the thrust available. 

Flight Control Modifications 

The basic F-18 FCS was extensively modified for the 
incorporation of another computer to provide research ca- 
pabilities. The flight control computers were upgraded to 
the latest production hardware and software configurations. 
This upgrading generated spare card slots in the flight con- 
trol computer chassis. An additional computer, a 1750A 
programmable in Ada, was added to the system in three 
spare card slots (Fig. 2). Ada is a programming language 
based on PASCAL, originally developed on behalf of the 
U.S. Department of Defense for use in embedded computer 
systems. Additional analog I/O cards were developed to 
drive the TVCS actuators. Modifications were also made 
to the mother board to accommodate the additional boards. 

The 701E computer and the 1750A communicate through 
dual port RAM. The pitch rate and yaw rate gyro signals 
were run through additional analog to digital converters 
(A/Ds) to provide 100 deg/sec rates to the RFCS without 
affecting the normal 60 deg/sec rates used by the basic 
F-18 system. 

Extensive software modifications were made to allow the 
basic F-18 control system and the RFCS to work together. 
Modifications were made in the executive, input selection 
monitoring, actuator signal management, built-in test, and 
data management 

The basic F-18 system was programmed to transfer data 
to the RFCS by way of dual port RAM twice in each frame; 
once after it has completed its input selection and monitor- 
ing and once after it has finished its control law computa- 
tions. After the first data transfer, the basic F-18 system 
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waits up to 2.2 msec for data from the RFCS before it pro- 
cesses the actuator signal management (Fig* 3). Software 
was added to the basic F-18 system to control and monitor 
the turning vane actuators and to monitor the additional high 
rate gyro signals. 

The 701E 1553 bus data management was also heavily 
modified. An additional message was input to the basic F- 1 8 
system with information from the MC for use in the RFCS. 
Two flight control output messages were modified to be data 
programmable from the RFCS and output at 80 Hz. One 
of these messages can output data from the basic F-18 sys- 
tem or RFCS while the other is strictly data from the RFCS. 
These messages were added to provide real-time data mon- 
itoring during flight test 

Avionics Modifications 

Major modifications for the avionic systems were re- 
quired to provide additional information to the FCS, obtain 
additional information from the FCS, to add and modify pi- 
lot displays, and add a remotely augmented vehicle (RAV) 
interface. These modifications required software changes in 
the MC. 

Modifications were made to the MC executive, input, and 
output modules. Routines were also added to the MC to 
provide to the RFCS angle-of-atiack and angle-of-sideslip 
rate calculated from inertial navigation system (INS) data. 
In addition, engine parameters were sent to the RFCS for 
gain scheduling. The flight control needed these parameters 
computed at 80 Hz, therefore, the MC executive was modi- 
fied to increase the maximum rate from 20 to 80 Hz. 

Remote terminals not on the HARV 1553 bus were re- 
moved from the processing loop in the MC to allow time 
to complete the added 80-Hz loops. Existing lower rate re- 
mote terminals were transferred from bus 1 to bus 2 to allow 
room for the 80-Hz messages on the bus. The bus 1 utiliza- 
tion is now at approximately 85 percent and bus 2 is now at 
approximately 50 percent. 

The modifications to the MC and FCS changed the way 
the MC was used. The HARV MC now provides inner loop 
feedback data to the RFCS and has no weapon systems tasks. 
To provide a backup capability, the two MCs were given 
identical loads. To prevent bus contention on the two main 
buses, only one MC is powered at a time. If an MC fails, 
the pilot switches power to the other MC through an existing 
cockpit switch. 

Modifications were made to existing display pages on the 
DDIs to add information about the RFCS, Additional RFCS 
information is presented to the pilot on the head-up display 
(HUD) (Fig. 4). An additional remote terminal was added 
to the 1553 bus to allow the MC to accept data from ground 
based computers through the use of the RAV system. The 
RAV can be used to generate displays to aid the pilot in 
reaching precise flight conditions and to provide inputs di- 
rectly to the RFCS from a ground computer. The RAV sys- 
tem contains one message of 16 words at 80 Hz. 


Hydraulic System Modifications 

The addition of the turning vanes and actuators required 
modification to the hydraulic system. The turning vane ac- 
tuators only use one of the hydraulic systems, unlike the 
other surfaces on the F-18 aircraft which are powered by 
both systems to allow surface control with one hydraulic 
system failed. The turning vane actuators are deactivated 
with the loss of a single hydraulic supply. 

The turning vanes use aileron actuators which were modi- 
fied to reduce the damping time after an actuator failure. The 
hardware design of the turning vane mechanical system al- 
lows actuator extension of 3.1 in. before there is structural 
interference, but the full stroke of the actuators is 4.38 in. 
Therefore, the actuators are being modified to include a me- 
chanical stop at 3 in. of stroke. 

Validation Approach 

The main thrust in validation testing is to identify areas 
where the system functions differently than expected and 
measure the difference. A detailed knowledge of how the 
system is expected to perform is required to identify these 
areas. In addition, the system must be thoroughly exercised 
in as close to the actual system environment as possible. 
This approach required the development of a high fidelity 
six -degree -of-freedom simulation that could easily be con- 
figured to use various pieces of flight hardware. 

The design philosophy emphasized that the basic F-18 
system would always be available as a backup to the re- 
search system. This allowed the research system to be 
treated as a noncritical element of the control system. The 
amount of validation testing required for the basic F-18 sys- 
tem was not reduced since it had to be heavily modified to 
incorporate the RFCS. The MC became critical to the op- 
eration of the RFCS because of the integration of sideslip 
rate and angle of attack calculated from INS parameters into 
the inner loop of the control system, the use of engine pa- 
rameters as gain schedule inputs, and the addition of the ca- 
pability to modify RFCS surface commands with external 
RAV inputs. 

The RFCS control laws are written in Ada and cross- 
compiled to the flight central processing unit (CPU). The 
use of a higher order language (HOL) reduced the develop- 
ment time and simulation integration, 7 but had no effect on 
the scope of verification testing required. 

The production FCS control laws were designed to func- 
tion with a wide range of external stores that change the 
mass, inertia, and aerodynamic properties of the aircraft. 
The addition of the TVCS, however, increased the pitch in- 
ertia significantly more than any existing stores configura- 
tion. Piloted simulation was used to verify that the increased 
weight and pitch inertia did not adversely affect the basic 
HARV handling qualities or spin recovery. Existing struc- 
tural notch filters in the longitudinal axis may not adequately 
match the structural modes of the modified aircraft, which 
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creates a potential problem. Any modifications required will 
be determined after ground vibration tests. 

As with any control system design, linear analysis was 
used to verify classical stability, linear performance, and sta- 
bility margins specified in MIL SPEC 8785 for the RFCS 
control laws. Approximately 150 flight conditions were 
used, varying Mach, altitude, angle of attack, and gross 
weight A linear structural bending model was used in addi- 
tion to the rigid body aerodynamic model to evaluate struc- 
tural mode interaction and notch filter performance. The lin- 
ear analysis was rerun with each update of the aerodynamic 
or thrust vectoring models to assure adequate stability mar- 
gins. Parametric variations in vectoring performance were 
used to indicate system sensitivity to inaccuracies in the sim- 
ulation models. Time history and frequency response com- 
parisons between the linear analysis and the nonlinear sim- 
ulation were used to validate the linear model results. 

Sine sweep inputs to the nonlinear simulation were used 
to generate closed-loop and open-loop frequency responses. 
Evaluation of open-loop stability from closed-loop fre- 
quency sweeps is possible because of the availability of in- 
ner loop control system parameters in the dual port RAM. 

Validation Tests 

Many types of tests are required for the system validation. 
Farh test is designed to ensure certain aspects of the system 
are performing as expected. These tests rely upon the accu- 
racy of results from the various simulations. Ultimately a 
subset of the total tests is run on an aircraft-in-the-loop sim- 
ulation to verify that the other simulations accurately model 
the aircraft systems. 

Control system tests address two areas. The first area in- 
cludes the modified F-18 systems. Tests on these systems 
are performed to verify that the basic F-18 control system 
performance was not modified. This was done by compar- 
ing time history responses and frequency responses of the 
original F-18 system with the modified basic F-18 system. 
The second area includes the RFCS and the interface be- 
tween the RFCS and the basic F-18 control system. The 
RFCS was tested to verify the system implementation was 
as expected and that it also provided desirable flying qual- 
ities. The interface is tested to ensure that information is 
passed between the two systems properly and any errors will 
be recognized. These tests include time history responses to 
steps or pulses, frequency responses, and system reaction to 
inputs beyond the expected signal range. 

Failure mode and effects tests (FMET) consist of insert- 
ing failures at various flight conditions, which verify that the 
FCS detects the failures, reacts properly to the failure, and 
that the effect of the failure is acceptable. Specific tests were 
included to prove the RFCS could not affect the basic F- 
18 control system when the RFCS is not engaged. Failures 
which occur when the RFCS has control of the aircraft re- 
sult in downmoding the basic F-18 system. Therefore, tests 
were performed to determine the ability of the basic F-18 to 


recover from any condition the RFCS could generate. The 
F-18 system was also tested to assess the effects of added in- 
ertias in the pitch axis on transients resulting from failures. 

Piloted evaluation is used to determine that the basic F-18 
system still provides acceptable flying qualities and could 
recover from any situation the RFCS generates. This eval- 
uation was made by having pilots perform normal and ag- 
gressive tasks with a properly functioning system. Failures 
were inserted to determine how the pilot dealt with tran- 
sients generated by system reconfiguration and to exercise 
emergency procedures. The flying qualities of the RFCS 
were also evaluated. 

The majority of the validation testing is performed with a 
hardware-in-the-loop (HIL) simulation. An extensive series 
of on-aircraft tests is necessary to complete the validation 
of the flight system. These tests cover the aspects which in- 
volve the integration of the system into the aircraft systems 
and structure. 

Proof load tests are performed to show that the structure 
will withstand 110 percent of the predicted load. Ground 
vibration tests are performed to verify the structural modes 
match predictions. Ground resonance tests are performed 
to ensure there are no interactions between the structure and 
the control system. This test increases the flight sensor feed- 
back gains to show that the system is free of structural reso- 
nance at twice the maximum system gain that will be met in 
flight Limit cycle tests are performed to verify the control 
system rigid body gain and phase margins are as predicted. 
This test increases the simulated feedback sensor gains un- 
til an instability is met or to show the measured closed-loop 
gain and phase margins change accordingly. Aircraft sys- 
tems tests verify that the aircraft systems function properly 
and do not adversely affect each other. Hydraulic capacity 
tests are run to verify the aircraft could operate all systems 
sufficiently. Electromagnetic interference (EMI) tests ver- 
ify systems do not react to interference generated by sources 
that will be met by the aircraft during its operation. 

Flight test is also included in the validation of the RFCS. 
The basic F-18 system will be evaluated in flight for its abil- 
ity to recover from possible transients before engaging the 
RFCS. The RFCS can also be monitored while the aircraft is 
controlled by the basic F-18 control system. Thus the feed- 
back parameters generated from INS data can easily be val- 
idated in flight before being used. 

Tools 

As in all system validation tasks, the development of tools 
and facilities was a large effort. Several of the test system 
developments that were underway for the Integrated Test Fa- 
cility (1TF)* were mature enough for the HARV test team to 
include in the validation plans. The ITF systems included a 
time history data recording system, a universal memory net- 
work (UMN), a simulation interface device (SID), and an 
auto lest system. Figure 5 shows the relationship between 
the components. 
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The time history data recording system can capture all 
the parameters available in the simulation and both 1SS3 
buses. This capability was useful for looking at additional 
information about a test when unexpected results were ob- 
tained. The UMN distributes real-time data to many com- 
puters. This capability gave the history data recording ac- 
cess to all the simulation parameters and allowed the devel- 
opment of real-time displays for a small number of param- 
eters. These parameters may reside in any of the comput- 
ers in the test system including the F- 18 computers and the 
RFCS. The SID is the interface between the simulation and 
the flight control computers. It is capable of signal conver- 
sion, isolation, protection and modifying signals for struc- 
tural resonance tests, or failure mode and effects tests. 

The auto test system was particularly useful. It automat- 
ically ran predefined tests on the various simulations by the 
use of test scripts. The test scripts could set up the simu- 
lation, define the test type, define the test conditions, ma- 
nipulate inputs to the system under test, and record test re- 
sults with the time history data recording system. Once a 
test script was written and worked properly, it could be run 
whenever necessary. This capability allows many tests to be 
repeated in less time than it took to perform manually. 

Another tool used during verification and validation 
(V&V) was the capability incorporated in the RFCS to make 
available any memory location in the basic F-18 system or 
in the RFCS computer on the 1553 bus. This allowed inter- 
nal FCS parameters to be reviewed as part of the validation 
testing and during system troubleshooting. 

Simulations 

Simulations were major tools in the testing of the HARV 
systems. A simulation which could be configured was de- 
veloped to provide the flexibility to include the flight hard- 
ware necessary (Fig. 5). An all-software simulation con- 
sisted of two simulation computers, a cockpit with two flight 
DDIs, a HUD, and flight MCs. One of the simulation com- 
puters contains the aerodynamic model, basic F-18 control 
laws, actuator models, and interfaces to run the cockpit and 
strip charts, while the other simulation computer contains 
the RFCS control laws in Ada. The HIL simulation con- 
sisted of all of the previously mentioned systems plus ac- 
tual flight control computers and analog actuator models. 
The ironbird simulation included aircraft actuators instead 
of analog actuator models for all surfaces except the leading- 
and trailing-edge flaps. The flaps are not used for dynamic 
maneuvering and were not required for testing. The sim- 
ulation can also be interfaced to the HARV aircraft The 
majority of the V&V testing was done on the HIL, with a 
subset completed on the ironbird and the aircraft. Figure 6 
lists the types of tests each simulation could support 

Problems Encountered During Validation 

During the testing of the HARV systems, problems have 
been met in the interfaces between the control and the avion- 
ics systems. These problems involved the activation of pilot 
displays, the resetting of discretes to engage the RAV, and 


the effects of angle of attack sent to the MC going beyond 
the expected range. These problems were easily resolved 
and corrected. Other problems were also encountered which 
were not specifically part of the HARV system. 

The documentation on the F-18 systems describes the sys- 
tem in varying degrees of detail. Finding the one piece of in- 
formation that was needed was a recurring problem because 
it required searching through several of the volumes of in- 
formation. Progress was hampered during the integration 
of the flight hardware into the simulation because of the in- 
ability to sort quickly through the information. Creating and 
maintaining communication paths between knowledgeable 
people located across the country was difficult. The indi- 
vidual with the proper knowledge about the system was not 
always available to answer questions. These problems will 
become much harder to deal with in a larger, more complex 
system. The development of systems 9 that can quickly sort 
through information which is easily maintained and con- 
trolled could save many months of searching for accurate 
answers. These information systems could be made avail- 
able to locations in different geographical areas. This would 
allow questions to be answered even when the most knowl- 
edgeable individuals are no longer available. 

The ability to collect the data that the F-18 system gen- 
erated was a very useful asset. However, the large amounts 
of data generated made it difficult to quickly review even a 
small set of parameters. This problem is being addressed by 
adding the ability to capture and display on a Unix® work- 
station a small set of real-time parameters from all sources. 

Concluding Remarks 

The high alpha research vehicle (HARV) system modifi- 
cation to add a research flight control system (RFCS) and 
turning vane control system (TVCS) included the integra- 
tion of avionics, engine parameters, and external inputs into 
the flight control system. This integration introduced flex- 
ible experimental components into the system. The val- 
idation of the HARV system modification included many 
aspects. The system design included the capability to ex- 
tract internal parameters from the control systems. The in- 
terface between the RFCS and the basic F-18 system con- 
tained checks and balances to ensure the safety of the total 
system was not compromised by unforeseen circumstances. 
The testing addressed critical issues to ensure the backup 
system was not compromised by the addition of the experi- 
mental systems. The Integrated Test Facility (ITF) systems 
were used to automate repetitive tests, collect large amounts 
of data, and allow the test team to concentrate on interpret- 
ing test results rather than the test system. The test team 
not only encountered problems with the system under test 
but also with the inability to sort through the information in 
an efficient manner, maintaining communication over large 
distances, and obtaining desired results in a timely manner. 

In conclusion, the validation of an integrated system must 
begin with system design. The testability, ability to respond 

®Unix it a registered trademark of AT&T Bell Labs, Murray Hills. NJ. 
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to unexpected circumstances, and the ability to quickly ob- 
tain accurate answers about correct system behavior must 
all be considered as important aspects of system design to 
allow efficient validation. 
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HARV test requirements 
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